UpHeron
All vulnerabilities

Servers and applications

CVE-2025-62175

Disabled and suspended user accounts stay connected to the streaming API and can connect afterwards

Severity
Medium 4.3
Published
13 Oct 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.2.27, 4.3.14, 4.4.6
Also known as
GHSA-r2fh-jr9c-9pxh
Sources
NVD, Project advisories (GitHub)

Description

Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. This allows disabled or suspended accounts to continue receiving real-time updates through existing streaming connections and to establish new streaming connections, even though…

Affected software

SoftwareAffected versions
MastodonServers and applications · cpe:a:joinmastodon:mastodon
  • Every version before 4.2.27
  • From 4.3.0 before 4.3.14
  • From 4.4.0 before 4.4.6
MastodonServers and applications · github:mastodon/mastodon
  • Every version before 4.2.27

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-62175
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62175
  • GitHub Advisory Database https://github.com/advisories/GHSA-r2fh-jr9c-9pxh
  • github.com https://github.com/mastodon/mastodon/security/advisories/GHSA-r2fh-jr9c-9pxh